Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A fail-open authentication check was detected. Returning `true` when a secret, token, or API key is empty bypasses the security control by allowing access without credentials when the configuration is absent or uninitialized. Ensure that unconfigured secrets default to denying access (e.g., returning `false`).
Generating a `:prepared-register` token that embeds an existing `:profile-id` allows an attacker to bypass registration validation using an Alternate Path, resulting in account takeover. Remove `:profile-id` from the `:prepared-register` token map so that active profiles are forced through the secure logical flow.
Authentication bypass via alternate channel (CWE-288). An "X-Admin-Token" style HTTP header is read from the request and its raw value is used as an authenticated identity — either passed directly into a session/identity constructor or compared with `==` against a stored `adminToken` pointer to short-circuit RBAC checks. There is no cryptographic verificatio
Sensitive authentication secrets (such as MFA or TOTP secrets) should not be loaded from user-controlled request parameters. Falling back from a server-side session to a request object via '??' or '?:' allows an attacker to inject their own secret when the session variable is unset or expired, bypassing authentication phases (CVE-2026-28510). Retrieve such s
Returning NextResponse.next() solely based on the presence of an HTTP header without validating its value can lead to authentication or authorization bypass. In middleware, this may allow malicious clients to bypass checks and spoof downstream identities. Verify the header value against a known secret or perform token validation before proceeding, and strip
The middleware conditionally validates the 'Authorization' header only if it is present and formatted correctly, but falls through to request processing if it is absent or malformed. If this endpoint is meant to be protected, an attacker can bypass authentication by omitting the header. Ensure that the presence and validity of the Authorization header is enf
The application explicitly limits MFA verification to instances where the authentication type is "local". Alternative mechanisms like LDAP, SAML, or External could bypass MFA unless every provider identically replicates the verification. Centralize MFA checks around the user object and session properties regardless of the initial authentication provider.
FastAPI route handler invokes validate_code() (which internally compiles and execs attacker-supplied Python source) without an authentication dependency declared in the route decorator. Because Python evaluates function-definition decorators and default-argument expressions at the moment exec() processes the definition, an unauthenticated attacker can embed
Anonymous-access allowlist gated by `endswith()` on a raw HTTP path is vulnerable to suffix spoofing (CVE-2024-10081, CWE-288 / CWE-420): an attacker can craft a URL whose raw path ends with one of the allowlisted tokens (e.g. '/Authentication') while the request is dispatched by the router to a different, privileged endpoint, yielding an authentication bypa
